SMSEagle is aware of two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, disclosed publicly on 21 October 2026. Both allow remote code execution and are rated CVSS 9.2 (Critical). PHP is a component of the SMSEagle software, so devices running vulnerable PHP versions are affected.
Devices exposed directly to the Internet are at the highest risk and require immediate action. SMSEagle software 7.0.2, which updates the vulnerable PHP versions, has been released (22 October 2026). We recommend updating all devices to this version immediately. Internet-exposed devices that cannot be updated right away should be taken offline until the update is installed. Devices operating only in a local network (LAN) and not reachable from the Internet can continue to work.
All SMSEagle device models running SMSEagle software lower than 7.0.2 are affected.
The vulnerabilities are present in all PHP versions before 8.5.12, 8.4.27, 8.3.36, 8.2.35, 7.4.33 (and lower). The web GUI and the API of the device are served by PHP, so devices whose web interface or API can be reached from the public Internet are exposed to remote attacks.
Both issues are rated CVSS 9.2 and allow an attacker to execute code on the affected system remotely. Proof-of-concept exploits have begun to circulate publicly, so we expect attempts to exploit these issues against devices reachable from the Internet.
| CVE | Weakness | Impact | CVSS |
|---|---|---|---|
| CVE-2026-109618 | Memory corruption when PHP handles out-of-memory conditions | Remote code execution (RCE) without authentication | 9.2 |
| CVE-2026-109619 | Use of stale global state | Remote code execution (RCE) | 9.2 |
Update the device to SMSEagle software 7.0.2 immediately. If you cannot update right away, take the device offline from public networks now: remove port forwarding or NAT rules to the device, block inbound traffic to it on the firewall, or disconnect it from the public network.
Keep the device isolated until software 7.0.2 is installed.
Devices that are not reachable from the Internet can continue to operate. Make sure that no port forwarding, reverse proxy, cloud tunnel or VPN gives public access to the device, and update to software 7.0.2 as soon as possible.
SMSEagle software 7.0.2 was released on 22 October 2026. It updates the vulnerable PHP versions to patched releases. We strongly recommend to update your software to this version.
To update, open the web GUI, go to Settings > Updates and select “Check for software update now”.
If your device has no Internet access, contact the SMSEagle Support Center to receive an offline update package. Put Internet-exposed devices back online only after the update is installed.
For devices that cannot be updated to software 7.0.2, SMSEagle has prepared a dedicated security patch that addresses the vulnerabilities. Download the patch file and install it as described below.
Questions about this advisory can be sent to the SMSEagle Support Center.
| Date | Version | Change |
|---|---|---|
| 23 October 2026 | 1.2 | Security patch released for devices that cannot be updated to 7.0.2 |
| 22 October 2026 | 1.1 | SMSEagle software 7.0.2 released |
| 21 October 2026 | 1.0 | Initial publication |
SMSEagle continuously monitors and reports cybersecurity threats, enabling our customers to proactively take necessary mitigation steps to maintain the security of their devices. To assist you in managing and mitigating security risks SMSEagle offers product advisories.
